Cwikius-Spring
/
spring-security
mirror of https://github.com/spring-projects/spring-security.git
1
0
Fork 0
Code Issues Packages Projects Releases Wiki Activity

Fix headers@defaults-disabled=true with no children 

Previously <headers defaults-disabled="true"/> would fail if there were
no children with an IllegalArgumentException. This allows using
defaults-disabled="true" and no children as an alias for disabled="true".

Fixes gh-3986
This commit is contained in:
Rob Winch 2016-09-19 14:53:51 -05:00
parent 81ebdecd8a
commit 49f7c98c3e
2 changed files with 19 additions and 7 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

6
config/src/main/java/org/springframework/security/config/http/HeadersBeanDefinitionParser.java
View File

@ -111,13 +111,13 @@ public class HeadersBeanDefinitionParser implements BeanDefinitionParser {
parseHeaderElements(element); parseHeaderElements(element);
if (disabled) { boolean noWriters = headerWriters.isEmpty();
if (!headerWriters.isEmpty()) { if (disabled && !noWriters) {
parserContext parserContext
.getReaderContext() .getReaderContext()
.error("Cannot specify <headers disabled=\"true\"> with child elements.", .error("Cannot specify <headers disabled=\"true\"> with child elements.",
element); element);
} } else if (noWriters) {
return null; return null;
} }

12
config/src/test/groovy/org/springframework/security/config/http/HttpHeadersConfigTests.groovy
View File

@ -109,6 +109,18 @@ class HttpHeadersConfigTests extends AbstractHttpConfigTests {
// --- defaults disabled // --- defaults disabled
// gh-3986
def 'http headers defaults-disabled with no override'() {
httpAutoConfig {
'headers'('defaults-disabled':true) {
}
}
createAppContext()
expect:
getFilter(HeaderWriterFilter) == null
}
def 'http headers content-type-options'() { def 'http headers content-type-options'() {
httpAutoConfig { httpAutoConfig {
'headers'('defaults-disabled':true) { 'headers'('defaults-disabled':true) {